# Attackers Used an Unknown Flaw to Take Over BeyondTrust Remote Support Appliances _On October 15, 2026, BeyondTrust disclosed CVE-2026-102764, a flaw that lets an attacker with no login take over Remote Support appliances. Mandiant says a suspected China-linked espionage group exploited it in late August, then gained access to the credentials the appliance stores._ By Johannes Keienburg, CEO & Founder Published: 2026-10-19 Source: https://www.cakewalk.security/blog/beyondtrust-remote-support-cve-2026-102764 --- ## An Attacker With No Login Gained Access to the Credentials Remote Support Keeps A suspected China-linked espionage group broke into BeyondTrust Remote Support appliances in late August 2026, says Google's Mandiant team. The group used a zero-day, a flaw with no fix yet. BeyondTrust disclosed the flaw, CVE-2026-102764, on October 15, 2026. It lets an attacker with no login upload files to the appliance. Once inside, the group made itself root, the administrator account with full control of the appliance host. BeyondTrust's [post on the attack](https://www.beyondtrust.com/blog/entry/bt26-05) describes such an appliance as "a credential source and a map of who connects to what." > After establishing a foothold through the web shell, the actor elevated from the web service account to root-level control of the appliance host. This gave them access to every credential the appliance stored or brokered and the ability to modify files that survive reboot and configuration reset. _Google Threat Intelligence Group and Mandiant, ARMORY CASTLE Exploits BeyondTrust, October 15, 2026_ IT teams use BeyondTrust Remote Support to access and troubleshoot the computers they look after. It runs as an appliance, either self-hosted or hosted by BeyondTrust, and stores the privileged credentials those sessions use. The flaw affects all supported versions up to 26.2.3. According to BeyondTrust, the group hit two customers on August 29, one hosted by BeyondTrust and one self-hosted. The company has seen no activity from the group since August. BeyondTrust patched hosted customers automatically, though Mandiant says hosted customers should still rotate credentials and review their configuration. Self-hosted customers need the BT26-05 patch now. Mandiant tells organizations to prepare for wider exploitation now that the flaw is public. SolarWinds fixed a flaw in [Access Rights Manager](/blog/solarwinds-access-rights-manager-hardcoded-key) on September 17, 2026. IBM fixed 22 in [Verify Identity Access](/blog/ibm-verify-identity-access-22-flaws) on October 7. ## The Group Went for the Vault, Then Gave Itself Standing Access Mandiant recovered the commands the group ran with the appliance's own secrets utility. The group tried the vault of one site [service account](/glossary/service-account) first, then fell back to the appliance-wide password safe that holds the stored administrative credentials. Afterward the group deleted the utility's log. Mandiant's rotation list runs from administrator credentials and API client secrets to Security Assertion Markup Language (SAML) signing keys. It ends with any credential typed into a support session during the window. Mandiant also says to rotate only after patching, since new credentials set on an appliance the attacker still controls are exposed too. The group then made its access last by raising one compromised account's permissions from No Access to Administrator. The change covered Jump Items, the downstream systems an account may open remote sessions on. > This configuration change granted the threat actor permanent, unrestricted authorization to launch remote sessions to downstream systems populated within the appliance's Jump Item list. _Google Threat Intelligence Group and Mandiant, ARMORY CASTLE Exploits BeyondTrust, October 15, 2026_ Mandiant's hardening advice targets this change. The default Jump Item role in every group policy goes to No Access, with roles granted through policy rather than per user. API accounts get the [minimum permission set](/glossary/least-privilege) and a named owner for any account that can manage users or Jump Items. Mandiant says these controls reduce exposure and limit the damage after a break-in. They do not replace the patch. > An edit made with root on the appliance went through no request at all. What a company can govern is how admin rights are granted before anyone breaks in, which means to a named person and for a set time. In Cakewalk's Human Access product, admin rights in a connected app can be requested with an end date the approver can shorten. When the date passes, taking them back becomes a task for the app owner. The request keeps one record of who asked and who approved. _Comment from Gil Röder, CPO & Co-Founder_ Source: Google Threat Intelligence Group and Mandiant, [ARMORY CASTLE Exploits BeyondTrust](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust), October 15, 2026.